Ivanti · Pulse Connect Secure
CVE-2021-22900
Ivanti Pulse Connect Secure Unrestricted File Upload Vulnerability
What it is
A vulnerability allowed multiple unrestricted uploads in Pulse Connect Secure before 9.1R11.4 that could lead to an authenticated administrator to perform a file write via a maliciously crafted archive upload in the administrator web interface.
CISA: Ivanti Pulse Connect Secure contains an unrestricted file upload vulnerability that allows an authenticated administrator to perform a file write via a maliciously crafted archive upload in the administrator web interface.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: May 3, 2022
More exploited flaws from Ivanti
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Nov 3, 2021 | Code Execution | Pulse Connect Secure | High 7.2 | 91% |
| Nov 3, 2021 | Code Execution | Pulse Connect Secure | High 7.2 | 96% |
| Nov 3, 2021 | Arbitrary File Read | Pulse Connect Secure | Critical 9.9 | >99.9% |
| Nov 3, 2021 | Use-After-Free | Pulse Connect Secure | Critical 10.0 | 47% |
| Nov 3, 2021 | Collaboration Suite Buffer Overflow | Pulse Connect Secure | High 8.8 | 41% |
| Nov 3, 2021 | Command Injection | Pulse Connect Secure | High 8.8 | 23% |
| Oct 13, 2026 | Authentication Bypass by Spoofing | Connect Secure | High 8.6 | 87% |
| Jun 11, 2026 | OS Command Injection | Sentry | Critical 10.0 | 99.9% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.